Twinned from https://github.com/cfsh/ninefold/issues/1034 by tools/beads/import_github.py's reconcile pass.
Suggestions from ninefold-reviewer's review of #1032
tools/reviewer/CHARTER.md's "Verdict format" instructs piping the verdict body into tools/reviewer/post_verdict.py via a bash heredoc. Pass-1 review of #1032 flagged that the original <<'VERDICT_EOF' delimiter is plain English and appears inside CHARTER.md's own fenced example — exactly the block a reviewer would naturally quote when citing "the verdict format" in a finding. The pass-2 fix renamed the delimiters to NF_VERDICT_END/NF_VERDICT_UNCHANGED_END and added an explicit warning telling the reviewer to use a different, arbitrary delimiter on any pass whose body needs to quote that exact snippet. That's a real improvement (a random/ugly token collides far less often than a common phrase), but it's still instruction-based, not structural: nothing stops a future pass from reproducing the fenced block verbatim and re-triggering the same class of bug, just with lower odds. A --body-file <path> flag on post_verdict.py (or accepting the body as stdin only when explicitly requested) would let the reviewer write its verdict to a temp file and sidestep heredoc quoting — and its self-referential collision risk — entirely.Low urgency: the current mitigation is adequate for now. Worth doing if post_verdict.py is touched again.
None.
No comments.